06d7a490467077392982f865b6f8a88a28b1c0200ec1d0aa4434afb7697515b0

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4acfd11721e5efef358cea94bc911cc_JaffaCakes118.pdf
Size

43KB
MD5

d4acfd11721e5efef358cea94bc911cc
SHA1

a001e918894b8b0584c1f7116c39545af30d1502
SHA256

06d7a490467077392982f865b6f8a88a28b1c0200ec1d0aa4434afb7697515b0
SHA512

821f789c5e50594c76f0f95a9b0def97643d17b19afeac60974fc50cafdc9a9ea10c31d760a7ba42d450d71f2173d5163c129fb21dee2d17b12c59185d83f2cd
SSDEEP

768:+JiQGzPXour39Xvq9Qxf5U5O+puoJxqZy8aeuTyMroQNQoiB+1Nkoi/DT3UAB3bM:QJGzPXR3dq9af5U5NpuoJxLkQNQQNkoT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2220	AcroRd32.exe
2220	AcroRd32.exe
2220	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d4acfd11721e5efef358cea94bc911cc_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bc03e9378c11f0a6948ed285223fb9f7

SHA1
fb0332c5835d48d201264ee18ffa517a75bf2423

SHA256
1c7590db16fcf5abb60451bb68ef04969edee33a08cc681bc4cb74a12b80c91d

SHA512
44b2890641cfa591da76bd09a769ae29492ba114db8f527cd4f9b4ea2f0d6d462a698e840cea38682838e435e46bb239f25e982316219f5ee5687b17a3be5ff9

Download Submit